<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	xmlns:s="http://criticalsystems.co.uk/schemas/instrumentation/02/2009"
	xmlns:msxsl="urn:schemas-microsoft-com:xslt"
	exclude-result-prefixes="msxsl s">
  <xsl:output method="xml" indent="yes" />

  <xsl:template match="s:systemInformation">
    <xsl:variable name="system" select="@name"/>
    <xsl:variable name="target" select="concat($system,'.Server')"/>
    <xsl:variable name="systemDisplayName" select="@displayName"/>
    <ManagementPack ContentReadable="true">
      <Manifest>
        <Identity>
          <ID><xsl:value-of select="$system"/>.Pack</ID>
          <Version>
            <xsl:value-of select="@version"/>
          </Version>
        </Identity>
        <Name><xsl:value-of select="$systemDisplayName"/> Management Pack</Name>
        <References>
          <Reference Alias="SCDW">
            <ID>Microsoft.SystemCenter.DataWarehouse.Library</ID>
            <Version>6.0.5000.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Windows">
            <ID>Microsoft.Windows.Library</ID>
            <Version>6.0.5000.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="System">
            <ID>System.Library</ID>
            <Version>6.0.5000.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="SC">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>6.0.5000.28</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Health">
            <ID>System.Health.Library</ID>
            <Version>6.0.5000.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <TypeDefinitions>
        <EntityTypes>
          <ClassTypes>
            <ClassType ID="{$target}" Accessibility="Public" Abstract="false" Base="Windows!Microsoft.Windows.LocalApplication" Hosted="true" Singleton="false" >
            </ClassType>
          </ClassTypes>
        </EntityTypes>
      </TypeDefinitions>
      <Monitoring>
        <Discoveries>
          <Discovery ID="{$system}.Discovery" Enabled="true" Target="Windows!Microsoft.Windows.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal">
            <Category>Discovery</Category>
            <DiscoveryTypes>
              <DiscoveryClass TypeID="{$target}">
                <Property TypeID="System!System.Entity" PropertyID="DisplayName" />
              </DiscoveryClass>
            </DiscoveryTypes>
            <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.FilteredRegistryDiscoveryProvider">
              <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
              <RegistryAttributeDefinitions>
                <RegistryAttributeDefinition>
                  <AttributeName>EventSource</AttributeName>
                  <Path>System\CurrentControlSet\Services\EventLog\<xsl:value-of select="@eventLog"/>\<xsl:value-of select="$system"/></Path>
                  <PathType>0</PathType>
                  <AttributeType>0</AttributeType>
                </RegistryAttributeDefinition>
              </RegistryAttributeDefinitions>
              <Frequency>15</Frequency>
              <ClassId>$MPElement[Name="<xsl:value-of select="$target"/>"]$</ClassId>
              <InstanceSettings>
                <Settings>
                  <Setting>
                    <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Name>
                    <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value>
                  </Setting>
                  <Setting>
                    <Name>$MPElement[Name="System!System.Entity"]/DisplayName$</Name>
                    <Value><xsl:value-of select="$systemDisplayName"/> computer</Value>
                  </Setting>
                </Settings>
              </InstanceSettings>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Values/EventSource</XPathQuery>
                  </ValueExpression>
                  <Operator>Equal</Operator>
                  <ValueExpression>
                    <Value Type="String">true</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </DataSource>
          </Discovery>
        </Discoveries>
        <Rules>
          <xsl:apply-templates select="s:subsystems/s:subsystem">
            <xsl:with-param name="mode">Rules</xsl:with-param>
            <xsl:with-param name="target" select="$target"/>
            <xsl:with-param name="eventLog" select="@eventLog"/>
            <xsl:with-param name="system" select="$system"/>
            <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
          </xsl:apply-templates>
        </Rules>
      </Monitoring>
      <Presentation>
        <Views>
          <View ID="{$system}.Alerts.View" Accessibility="Internal" Enabled="true" Target="{$target}" TypeID="SC!Microsoft.SystemCenter.AlertViewType" Visible="true">
            <Category>Alert</Category>
          </View>
          <View ID="{$system}.Inventory.View" Accessibility="Internal" Enabled="true" Target="{$target}" TypeID="SC!Microsoft.SystemCenter.InventoryViewType" Visible="true">
            <Category>Inventory</Category>
          </View>
          <View ID="{$system}.Events.View" Accessibility="Internal" Enabled="true" Target="{$target}" TypeID="SC!Microsoft.SystemCenter.EventViewType" Visible="true">
            <Category>EventCollection</Category>
          </View>
        </Views>
        <Folders>
          <Folder ID="{$system}.ViewFolder" Accessibility="Internal" ParentFolder="SC!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
        <FolderItems>
          <FolderItem ElementID="{$system}.Inventory.View" Folder="{$system}.ViewFolder" />
          <FolderItem ElementID="{$system}.Events.View" Folder="{$system}.ViewFolder" />
          <FolderItem ElementID="{$system}.Alerts.View" Folder="{$system}.ViewFolder" />
        </FolderItems>
        <StringResources>
          <xsl:apply-templates select="s:subsystems/s:subsystem">
            <xsl:with-param name="mode">StringResources</xsl:with-param>
            <xsl:with-param name="target" select="$target"/>
            <xsl:with-param name="eventLog" select="@eventLog"/>
            <xsl:with-param name="system" select="$system"/>
            <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
          </xsl:apply-templates>
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="ENU" IsDefault="true">
          <DisplayStrings>
            <DisplayString ElementID="{$system}.Pack">
              <Name><xsl:value-of select="$systemDisplayName"/> management pack</Name>
              <Description><xsl:value-of select="Description"/></Description>
            </DisplayString>
            <DisplayString ElementID="{$target}">
              <Name><xsl:value-of select="$systemDisplayName"/> computer</Name>
              <Description>A server with one or more of the subsystems of the <xsl:value-of select="$systemDisplayName"/> installed</Description>
            </DisplayString>
            <DisplayString ElementID="{$system}.Discovery">
              <Name><xsl:value-of select="$systemDisplayName"/> server discovery</Name>
            </DisplayString>
            <DisplayString ElementID="{$system}.Events.View">
              <Name><xsl:value-of select="$systemDisplayName"/> events</Name>
            </DisplayString>
            <DisplayString ElementID="{$system}.Alerts.View">
              <Name><xsl:value-of select="$systemDisplayName"/> alerts</Name>
            </DisplayString>
            <DisplayString ElementID="{$system}.Inventory.View">
              <Name><xsl:value-of select="@displayName"/> server inventory</Name>
            </DisplayString>
            <DisplayString ElementID="{$system}.ViewFolder">
              <Name><xsl:value-of select="$systemDisplayName"/></Name>
            </DisplayString>
            <xsl:apply-templates select="s:subsystems/s:subsystem">
              <xsl:with-param name="mode">DisplayStrings</xsl:with-param>
              <xsl:with-param name="target" select="$target"/>
              <xsl:with-param name="eventLog" select="@eventLog"/>
              <xsl:with-param name="system" select="$system"/>
              <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
            </xsl:apply-templates>         
          </DisplayStrings>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>
  </xsl:template>

  <xsl:template match="s:subsystem">
    <xsl:param name="mode"/>
    <xsl:param name="target"/>
    <xsl:param name="eventLog"/>
    <xsl:param name="system"/>
    <xsl:param name="systemDisplayName"/>
    <xsl:variable name="subsystem" select="@name"/>
    <xsl:variable name="subsystemDisplayName" select="@displayNname"/>

    <xsl:call-template name="BoundaryEventRules">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="subsystemDisplayName" select="$subsystemDisplayName"/>
      <xsl:with-param name="eventIdStart">100</xsl:with-param>
      <xsl:with-param name="symbolPrefix">Subsystem</xsl:with-param>
      <xsl:with-param name="level">Subsystem</xsl:with-param>
    </xsl:call-template>
    <xsl:call-template name="BoundaryEventRules">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="subsystemDisplayName" select="$subsystemDisplayName"/>
      <xsl:with-param name="eventIdStart">200</xsl:with-param>
      <xsl:with-param name="symbolPrefix">Thread</xsl:with-param>
      <xsl:with-param name="level">Thread</xsl:with-param>
    </xsl:call-template>
    <xsl:call-template name="BoundaryEventRules">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="subsystemDisplayName" select="$subsystemDisplayName"/>
      <xsl:with-param name="eventIdStart">300</xsl:with-param>
      <xsl:with-param name="symbolPrefix">Module</xsl:with-param>
      <xsl:with-param name="level">Module</xsl:with-param>
    </xsl:call-template>
    <xsl:call-template name="BoundaryEventRules">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="subsystemDisplayName" select="$subsystemDisplayName"/>
      <xsl:with-param name="eventIdStart">400</xsl:with-param>
      <xsl:with-param name="symbolPrefix">ExternalModule</xsl:with-param>
      <xsl:with-param name="level">External module</xsl:with-param>
    </xsl:call-template>
    <xsl:call-template name="BoundaryEventRules">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="subsystemDisplayName" select="$subsystemDisplayName"/>
      <xsl:with-param name="eventIdStart">500</xsl:with-param>
      <xsl:with-param name="symbolPrefix">Component</xsl:with-param>
      <xsl:with-param name="level">Component</xsl:with-param>
    </xsl:call-template>
    <xsl:call-template name="BoundaryEventRules">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="subsystemDisplayName" select="$subsystemDisplayName"/>
      <xsl:with-param name="eventIdStart">600</xsl:with-param>
      <xsl:with-param name="symbolPrefix">Function</xsl:with-param>
      <xsl:with-param name="level">Function</xsl:with-param>
    </xsl:call-template>
    <xsl:call-template name="OtherEventRules">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="systemDisplayName" select="$systemDisplayName"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="subsystemDisplayName" select="$subsystemDisplayName"/>
    </xsl:call-template>

  </xsl:template>

  <xsl:template name="BoundaryEventRules">
    <xsl:param name="mode"/>
    <xsl:param name="target"/>
    <xsl:param name="eventLog"/>
    <xsl:param name="system"/>
    <xsl:param name="eventIdStart"/>
    <xsl:param name="subsystem"/>
    <xsl:param name="symbolPrefix"/>
    <xsl:param name="level"/>

    <xsl:call-template name="BoundaryEntryExitRule">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="eventId">
        <xsl:value-of select="number($eventIdStart)"/>
      </xsl:with-param>
      <xsl:with-param name="symbolPrefix" select="$symbolPrefix"/>
      <xsl:with-param name="level" select="$level"/>
      <xsl:with-param name="type">Entry</xsl:with-param>
      <xsl:with-param name="typeText">entry</xsl:with-param>
    </xsl:call-template>

    <xsl:call-template name="BoundaryEntryExitRule">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="eventId">
        <xsl:value-of select="number($eventIdStart)+1"/>
      </xsl:with-param>
      <xsl:with-param name="symbolPrefix" select="$symbolPrefix"/>
      <xsl:with-param name="level" select="$level"/>
      <xsl:with-param name="type">NormalExit</xsl:with-param>
      <xsl:with-param name="typeText">has exited normally</xsl:with-param>
    </xsl:call-template>

    <xsl:call-template name="BoundaryAbnormalExitRule">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="eventId">
        <xsl:value-of select="number($eventIdStart)+2"/>
      </xsl:with-param>
      <xsl:with-param name="symbolPrefix" select="$symbolPrefix"/>
      <xsl:with-param name="level" select="$level"/>
    </xsl:call-template>

  </xsl:template>

  <xsl:template name="OtherEventRules">
    <xsl:param name="mode"/>
    <xsl:param name="target"/>
    <xsl:param name="eventLog"/>
    <xsl:param name="system"/>
    <xsl:param name="eventIdStart"/>
    <xsl:param name="subsystem"/>

    <xsl:call-template name="ExplicitEventRule">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="eventId">700</xsl:with-param>
      <xsl:with-param name="type">Information</xsl:with-param>
    </xsl:call-template>

    <xsl:call-template name="ExplicitEventRule">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="eventId">701</xsl:with-param>
      <xsl:with-param name="type">Warning</xsl:with-param>
    </xsl:call-template>

    <xsl:call-template name="ExplicitEventRule">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="eventId">703</xsl:with-param>
      <xsl:with-param name="type">Error</xsl:with-param>
    </xsl:call-template>

    <xsl:call-template name="ExceptionRule">
      <xsl:with-param name="mode" select="$mode"/>
      <xsl:with-param name="target" select="$target"/>
      <xsl:with-param name="eventLog" select="$eventLog"/>
      <xsl:with-param name="system" select="$system"/>
      <xsl:with-param name="subsystem" select="$subsystem"/>
      <xsl:with-param name="eventId">702</xsl:with-param>
    </xsl:call-template>
  </xsl:template>

  <xsl:template name="BoundaryEntryExitRule">
    <xsl:param name="mode"/>
    <xsl:param name="target"/>
    <xsl:param name="system"/>
    <xsl:param name="eventLog"/>
    <xsl:param name="eventId"/>
    <xsl:param name="subsystem"/>
    <xsl:param name="symbolPrefix"/>
    <xsl:param name="level"/>
    <xsl:param name="type" />
    <xsl:param name="typeText" />

    <xsl:variable name="ruleId"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/>.<xsl:value-of select="$symbolPrefix"/><xsl:value-of select="$type"/></xsl:variable>
    <xsl:variable name="ruleName" xml:space="preserve"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/><xsl:text> </xsl:text><xsl:value-of select="$symbolPrefix"/><xsl:text> </xsl:text><xsl:value-of select="$typeText"/></xsl:variable>
    <xsl:choose>
      <xsl:when test="$mode='Rules'">
        <Rule ID="{$ruleId}" Enabled="true" Target="{$target}" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
          <Category>Alert</Category>
          <DataSources>
            <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
              <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
              <LogName>
                <xsl:value-of select="$eventLog"/>
              </LogName>
              <Expression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">
                          <xsl:value-of select="$eventId"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">PublisherName</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$system"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Params/Param[1]</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$subsystem"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </Expression>
            </DataSource>
          </DataSources>
          <WriteActions>
            <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
              <!-- 0 = low, 1 = medium, 2= high-->
              <!-- 0 = info, 1= warning, 2 = critical -->
              <xsl:variable name="priority">
                <xsl:choose>
                  <xsl:when test="$level='Subsystem'">2</xsl:when>
                  <xsl:when test="$level='Thread'">1</xsl:when>
                  <xsl:otherwise>0</xsl:otherwise>
                </xsl:choose>
              </xsl:variable>
              <Priority>
                <xsl:value-of select="$priority"/>
              </Priority>
              <Severity>0</Severity>
              <AlertOwner />
              <AlertMessageId>$MPElement[Name="<xsl:value-of select="$ruleId"/>.AlertDisplayString"]$</AlertMessageId>
              <AlertParameters>
                <!--
              1. Subsystem            {0}
              2. Instance             {1}
              3. Module      -+       {2}
              4. Component    |
              5. Function    -+
              6. Process     -+       {3}
              7. Thread      -+
              8. Identity             {4}
            -->
                <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>
                <AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>
                <AlertParameter3>$Data/Params/Param[4]$.$Data/Params/Param[5]$, $Data/Params/Param[3]$</AlertParameter3>
                <AlertParameter4>$Data/Params/Param[6]$ - $Data/Params/Param[7]$</AlertParameter4>
                <AlertParameter5>$Data/Params/Param[8]$</AlertParameter5>
              </AlertParameters>
              <Suppression>
                <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>
                <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>
                <SuppressionValue>$Data/PublisherName$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[3]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[4]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[5]$</SuppressionValue>
              </Suppression>
              <Custom1 />
              <Custom2 />
              <Custom3 />
              <Custom4 />
              <Custom5 />
              <Custom6 />
              <Custom7 />
              <Custom8 />
              <Custom9 />
              <Custom10 />
            </WriteAction>
          </WriteActions>
        </Rule>
      </xsl:when>
      <xsl:when test="$mode='DisplayStrings'">
        <DisplayString ElementID="{$ruleId}">
          <Name><xsl:value-of select="$ruleName"/></Name>
          <Description>Rule that raises an alert for the <xsl:value-of select="$typeText"/> of a <xsl:value-of select="$level"/></Description>
        </DisplayString>
        <!--
        1. Subsystem            {0}
        2. Instance             {1}
        3. Module      -+       {2}
        4. Component    |
        5. Function    -+
        6. Process     -+       {3}
        7. Thread      -+
        8. Identity             {4}
        -->
        <DisplayString ElementID="{$ruleId}.AlertDisplayString">
          <Name><xsl:value-of select="$ruleId"/></Name>
          <Description><xsl:value-of select="$level"/> - <xsl:value-of select="$typeText"/>.
Subsystem: {0}
Instance: {1}
Source: {2}
Process/thread: {3}
Identity: {4}</Description>
        </DisplayString>
      </xsl:when>
      <xsl:when test="$mode='StringResources'">
        <StringResource ID="{$ruleId}.AlertDisplayString"/>
      </xsl:when>
    </xsl:choose>

  </xsl:template>

  <xsl:template name="BoundaryAbnormalExitRule">
    <xsl:param name="mode"/>
    <xsl:param name="target"/>
    <xsl:param name="system"/>
    <xsl:param name="eventLog"/>
    <xsl:param name="eventId"/>
    <xsl:param name="subsystem"/>
    <xsl:param name="symbolPrefix"/>
    <xsl:param name="level"/>

    <xsl:variable name="ruleName" xml:space="preserve"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/> <xsl:value-of select="$symbolPrefix"/><xsl:text> </xsl:text>abnormal exit</xsl:variable>
    <xsl:variable name="ruleId"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/>.<xsl:value-of select="$symbolPrefix"/>AbnormalExit</xsl:variable>
    <xsl:choose>
      <xsl:when test="$mode='Rules'">
        <Rule ID="{$ruleId}" Enabled="true" Target="{$target}" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
          <Category>Alert</Category>
          <DataSources>
            <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
              <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
              <LogName>
                <xsl:value-of select="$eventLog"/>
              </LogName>
              <Expression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">
                          <xsl:value-of select="$eventId"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">PublisherName</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$system"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Params/Param[1]</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$subsystem"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </Expression>
            </DataSource>
          </DataSources>
          <WriteActions>
            <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
              <!-- 0 = low, 1 = medium, 2= high-->
              <!-- 0 = info, 1= warning, 2 = critical -->
              <xsl:variable name="priority">
                <xsl:choose>
                  <xsl:when test="$level='Subsystem'">2</xsl:when>
                  <xsl:when test="$level='Thread'">1</xsl:when>
                  <xsl:otherwise>0</xsl:otherwise>
                </xsl:choose>
              </xsl:variable>
              <Priority>
                <xsl:value-of select="$priority"/>
              </Priority>
              <Severity>2</Severity>
              <AlertOwner />
              <AlertMessageId>$MPElement[Name="<xsl:value-of select="$ruleId"/>.AlertDisplayString"]$</AlertMessageId>
              <AlertParameters>
                <!--
              1. Subsystem            {0}
              2. Instance             {1}
              3. Module      -+       {2}
              4. Component    |
              5. Function    -+
              6. Process     -+       {3}
              7. Thread      -+
              8. Identity             {4}
              9. Exception ID -+      {5}
              10.Exception    -+
              11.Exception message    {6}
              12.Exception properties {7}
              13.Trace log            {8}
              14.Stack trace          {9}
            -->
                <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>
                <AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>
                <AlertParameter3>$Data/Params/Param[4]$.$Data/Params/Param[5]$, $Data/Params/Param[3]$</AlertParameter3>
                <AlertParameter4>$Data/Params/Param[6]$ - $Data/Params/Param[7]$</AlertParameter4>
                <AlertParameter5>$Data/Params/Param[8]$</AlertParameter5>
                <AlertParameter6>$Data/Params/Param[9]$ ($Data/Params/Param[10]$)</AlertParameter6>
                <AlertParameter7>$Data/Params/Param[11]$</AlertParameter7>
                <AlertParameter8>$Data/Params/Param[12]$</AlertParameter8>
                <AlertParameter9>$Data/Params/Param[13]$</AlertParameter9>
                <AlertParameter10>$Data/Params/Param[14]$</AlertParameter10>
              </AlertParameters>
              <Suppression>
                <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>
                <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>
                <SuppressionValue>$Data/PublisherName$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[3]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[4]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[5]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[10]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[11]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[12]$</SuppressionValue>
              </Suppression>
              <Custom1 />
              <Custom2 />
              <Custom3 />
              <Custom4 />
              <Custom5 />
              <Custom6 />
              <Custom7 />
              <Custom8 />
              <Custom9 />
              <Custom10 />
            </WriteAction>
          </WriteActions>
        </Rule>
      </xsl:when>
      <xsl:when test="$mode='DisplayStrings'">
        <DisplayString ElementID="{$ruleId}">
          <Name><xsl:value-of select="$ruleName"/></Name>
          <Description>Rule that raises an alert when a <xsl:value-of select="$level"/><xsl:text> </xsl:text>has thrown an exception to an external caller</Description>
        </DisplayString>
        <!--
          1. Subsystem            {0}
          2. Instance             {1}
          3. Module      -+       {2}
          4. Component    |
          5. Function    -+
          6. Process     -+       {3}
          7. Thread      -+
          8. Identity             {4}
          9. Exception ID -+      {5}
          10.Exception    -+
          11.Exception message    {6}
          12.Exception properties {7}
          13.Trace log            {8}
          14.Stack trace          {9}
        -->
        <DisplayString ElementID="{$ruleId}.AlertDisplayString">
          <Name><xsl:value-of select="$ruleId"/></Name>
          <Description>A <xsl:value-of select="$level"/><xsl:text> </xsl:text>has thrown an exception to an external caller.
Subsystem: {0}
Instance: {1}
Exception: {5} - {6}
Parameters: {7}
Source: {2}
Process/thread: {3}
Identity: {4}
See log: {8}
Stack: {9}</Description>
        </DisplayString>
      </xsl:when>
      <xsl:when test="$mode='StringResources'">
        <StringResource ID="{$ruleId}.AlertDisplayString"/>
      </xsl:when>
    </xsl:choose>
  </xsl:template>

  <xsl:template name="ExplicitEventRule">
    <xsl:param name="mode"/>
    <xsl:param name="target"/>
    <xsl:param name="system"/>
    <xsl:param name="eventLog"/>
    <xsl:param name="eventId"/>
    <xsl:param name="subsystem"/>
    <xsl:param name="type" />

    <xsl:variable name="ruleName" xml:space="preserve"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/><xsl:text> </xsl:text><xsl:value-of select="$type"/></xsl:variable>
    <xsl:variable name="ruleId"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/>.<xsl:value-of select="$type"/></xsl:variable>
    <xsl:choose>
      <xsl:when test="$mode='Rules'">
        <Rule ID="{$ruleId}" Enabled="true" Target="{$target}" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
          <Category>Alert</Category>
          <DataSources>
            <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
              <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
              <LogName>
                <xsl:value-of select="$eventLog"/>
              </LogName>
              <Expression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">
                          <xsl:value-of select="$eventId"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">PublisherName</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$system"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Params/Param[1]</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$subsystem"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </Expression>
            </DataSource>
          </DataSources>
          <WriteActions>
            <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
              <!-- 0 = low, 1 = medium, 2= high-->
              <!-- 0 = info, 1= warning, 2 = critical -->
              <xsl:variable name="severity">
                <xsl:choose>
                  <xsl:when test="$type='Error'">2</xsl:when>
                  <xsl:when test="$type='Warning'">1</xsl:when>
                  <xsl:otherwise>0</xsl:otherwise>
                </xsl:choose>
              </xsl:variable>
              <Priority>2</Priority>
              <Severity>
                <xsl:value-of select="$severity"/>
              </Severity>
              <AlertOwner />
              <AlertMessageId>$MPElement[Name="<xsl:value-of select="$ruleId"/>.AlertDisplayString"]$</AlertMessageId>
              <AlertParameters>
                <!--
              1. Subsystem            {0}
              2. Instance             {1}
              3. Module      -+       {2}
              4. Component    |
              5. Function    -+
              6. Process     -+       {3}
              7. Thread      -+
              8. Identity             {4}
              9. Detail               {5}
            -->
                <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>
                <AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>
                <AlertParameter3>$Data/Params/Param[4]$.$Data/Params/Param[5]$, $Data/Params/Param[3]$</AlertParameter3>
                <AlertParameter4>$Data/Params/Param[6]$ - $Data/Params/Param[7]$</AlertParameter4>
                <AlertParameter5>$Data/Params/Param[8]$</AlertParameter5>
                <AlertParameter6>$Data/Params/Param[9]$</AlertParameter6>
              </AlertParameters>
              <Suppression/>
              <Custom1 />
              <Custom2 />
              <Custom3 />
              <Custom4 />
              <Custom5 />
              <Custom6 />
              <Custom7 />
              <Custom8 />
              <Custom9 />
              <Custom10 />
            </WriteAction>
          </WriteActions>
        </Rule>
      </xsl:when>
      <xsl:when test="$mode='DisplayStrings'">
        <DisplayString ElementID="{$ruleId}">
          <Name><xsl:value-of select="$ruleName"/></Name>
          <Description>Rule that raises an alert when an <xsl:value-of select="$type"/> message is logged</Description>
        </DisplayString>
        <!--
          1. Subsystem            {0}
          2. Instance             {1}
          3. Module      -+       {2}
          4. Component    |
          5. Function    -+
          6. Process     -+       {3}
          7. Thread      -+
          8. Identity             {4}
          9. Detail               {5}
        -->
        <DisplayString ElementID="{$ruleId}.AlertDisplayString">
          <Name><xsl:value-of select="$ruleId"/></Name>
          <Description><xsl:value-of select="$type"/>: {5}
Subsystem: {0}
Instance: {1}
Source: {2}
Process/thread: {3}
Identity: {4}</Description>
        </DisplayString>
      </xsl:when>
      <xsl:when test="$mode='StringResources'">
        <StringResource ID="{$ruleId}.AlertDisplayString"/>
      </xsl:when>
    </xsl:choose>
  </xsl:template>

  <xsl:template name="ExceptionRule">
    <xsl:param name="mode"/>
    <xsl:param name="target"/>
    <xsl:param name="system"/>
    <xsl:param name="eventLog"/>
    <xsl:param name="eventId"/>
    <xsl:param name="subsystem"/>
    <xsl:variable name="ruleName" xml:space="preserve"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/><xsl:text> </xsl:text>exception</xsl:variable>
    <xsl:variable name="ruleId"><xsl:value-of select="$system"/>.<xsl:value-of select="$subsystem"/>.Exception</xsl:variable>
        <xsl:choose>
      <xsl:when test="$mode='Rules'">
        <Rule ID="{$ruleId}" Enabled="true" Target="{$target}" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
          <Category>Alert</Category>
          <DataSources>
            <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
              <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
              <LogName>
                <xsl:value-of select="$eventLog"/>
              </LogName>
              <Expression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">
                          <xsl:value-of select="$eventId"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">PublisherName</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$system"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Params/Param[1]</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">
                          <xsl:value-of select="$subsystem"/>
                        </Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </Expression>
            </DataSource>
          </DataSources>
          <WriteActions>
            <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
              <!-- 0 = low, 1 = medium, 2= high-->
              <!-- 0 = info, 1= warning, 2 = critical -->
              <Priority>2</Priority>
              <Severity>2</Severity>
              <AlertOwner />
              <AlertMessageId>$MPElement[Name="<xsl:value-of select="$ruleId"/>.AlertDisplayString"]$</AlertMessageId>
              <AlertParameters>
                <!--
              1. Subsystem            {0}
              2. Instance             {1}
              3. Module      -+       {2}
              4. Component    |
              5. Function    -+
              6. Process     -+       {3}
              7. Thread      -+
              8. Identity             {4}
              9. Exception ID -+      {5}
              10.Exception    -+
              11.Exception message    {6}
              12.Exception properties {7}
              13.Trace log            {8}
              14.Stack trace          {9}
            -->
                <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>
                <AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>
                <AlertParameter3>$Data/Params/Param[4]$.$Data/Params/Param[5]$, $Data/Params/Param[3]$</AlertParameter3>
                <AlertParameter4>$Data/Params/Param[6]$ - $Data/Params/Param[7]$</AlertParameter4>
                <AlertParameter5>$Data/Params/Param[8]$</AlertParameter5>
                <AlertParameter6>$Data/Params/Param[9]$ ($Data/Params/Param[10]$)</AlertParameter6>
                <AlertParameter7>$Data/Params/Param[11]$</AlertParameter7>
                <AlertParameter8>$Data/Params/Param[12]$</AlertParameter8>
                <AlertParameter9>$Data/Params/Param[13]$</AlertParameter9>
                <AlertParameter10>$Data/Params/Param[14]$</AlertParameter10>
              </AlertParameters>
              <Suppression>
                <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>
                <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>
                <SuppressionValue>$Data/PublisherName$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[3]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[4]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[5]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[10]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[11]$</SuppressionValue>
                <SuppressionValue>$Data/Params/Param[12]$</SuppressionValue>
              </Suppression>
              <Custom1 />
              <Custom2 />
              <Custom3 />
              <Custom4 />
              <Custom5 />
              <Custom6 />
              <Custom7 />
              <Custom8 />
              <Custom9 />
              <Custom10 />
            </WriteAction>
          </WriteActions>
        </Rule>
      </xsl:when>
      <xsl:when test="$mode='DisplayStrings'">
        <DisplayString ElementID="{$ruleId}">
          <Name><xsl:value-of select="$ruleName"/></Name>
          <Description>Rule that raises an alert when an exception is logged explicitly</Description>
        </DisplayString>        <!--
          1. Subsystem            {0}
          2. Instance             {1}
          3. Module      -+       {2}
          4. Component    |
          5. Function    -+
          6. Process     -+       {3}
          7. Thread      -+
          8. Identity             {4}
          9. Exception ID -+      {5}
          10.Exception    -+
          11.Exception message    {6}
          12.Exception properties {7}
          13.Trace log            {8}
          14.Stack trace          {9}
        -->
        <DisplayString ElementID="{$ruleId}.AlertDisplayString">
          <Name><xsl:value-of select="$ruleId"/></Name>
          <Description>An error has been logged - see exception details.
Subsystem: {0}
Instance: {1}
Exception: {5} - {6}
Parameters: {7}
Source: {2}
Process/thread: {3}
Identity: {4}
See log: {8}
Stack: {9}</Description>
        </DisplayString>
      </xsl:when>
      <xsl:when test="$mode='StringResources'">
        <StringResource ID="{$ruleId}.AlertDisplayString"/>
      </xsl:when>
    </xsl:choose>
  </xsl:template>

</xsl:stylesheet>